Symptoms

SAML AuthRequest and Assertion generation could fail if the configuration (IdpEntityID, ACS, SAML Attributes, and so on) contain special XML characters, such as [&,<,>,",'].

Impact

SAML AuthRequest and Assertion generation could fail.

Conditions

- Assertion signing is enabled on BIG-IP as IdP. - SAML Configuration (IdpEntityID, ACS, not-encrypted SAML Attributes, ACS URL, SP Entity ID, SLO URL) contains special characters, e.g. [&,<,>,",']

Workaround

You can replace special XML character with XML-escape codes in the configuration: " &quot; ' &apos; < &lt; > &gt; & &amp; For example, replace "http://f5.com/acs_url?user=5&password=pass" with "http://f5.com/acs_url?user=5&amp;password=pass"

Fix Information

The BIG-IP system, when configured as an Identity Provider (IdP), can now successfully create SAML assertions even when the BIG-IP configuration contains special XML characters.

Behavior Change